5

Since I want to protect my ssh connections, I set some global cipher suite options to restrict set of used algorithms. But recently I've encountered a server which doesn't support some of those algorithms. So, I need to selectively enable deprecated algorithms for a specific host record in client (my system) configuration.

I found out that the options override is not working as I expected. Let's take a minimal (not-)working example for the github:

HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256

Host github
    HostKeyAlgorithms ssh-rsa
    Hostname        github.com
    Port            22
    User            git
    PubkeyAuthentication yes
    IdentityFile    ~/.ssh/some-filename-here

Having that, I receive the following error (HostKeyAlgorithms is not overriden at all):

debug1: /home/username/.ssh/config line 14: Applying options for github
<...>
debug2: kex_parse_kexinit: ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256
<...>
Unable to negotiate with 192.30.252.130: no matching host key type found. Their offer: ssh-dss,ssh-rsa

It is similarly not working for the global PubkeyAuthentication no options with an override in a host configuration.

Also, the match doesn't help either:

match host github
    HostKeyAlgorithms ssh-rsa

So, is there a way to selectively redefine those options?

NOTE: I'm using the openssh-7.1_p2-r1 on gentoo.

3

OpenSSH options might behave somehow strange on the first sight. But manual page for ssh_config documents it well:

For each parameter, the first obtained value will be used. The configuration files contain sections separated by “Host” specifications, and that section is only applied for hosts that match one of the patterns given in the specification. The matched host name is usually the one given on the command line (see the CanonicalizeHostname option for exceptions.)

You might rewrite your config like this to achieve what you need:

Host github
    HostKeyAlgorithms ssh-rsa
    Hostname        github.com
    Port            22
    User            git
    PubkeyAuthentication yes
    IdentityFile    ~/.ssh/some-filename-here
Host *
    HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256
1

Apart from a few specific (often used) options like -p to set the port, there is the generic -o options.

ssh -o HostKeyAlgorithms=ssh-algamel

can override that value

  • Yes, but it is unusable for use cases like git over ssh. – Alexander Sergeev Apr 4 '16 at 10:56
  • Not enterily true: GIT_SSH="ssh -o HostKeyAlgorithm=XYZ" git push can override your settings on an individual basis – Anthon Apr 4 '16 at 11:06
  • Okay, but then it will affect each ssh connection which is made by git (when I put it in .bashrc). And, I think, every way to overcome the issue will be much more uglier then the proper ssh_config changes. – Alexander Sergeev Apr 4 '16 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.